refine-prompt
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts as untrusted data and offers to store the refined output in a local file at
.ai/PROMPT.md. This creates a vulnerability surface where malicious instructions within a prompt could be persisted and later executed by an agent reading the file. - Ingestion points: The skill ingests arbitrary text for refinement in
SKILL.md. - Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands in the output stored to the file.
- Capability inventory: The skill utilizes the ability to append content to the local filesystem.
- Sanitization: No sanitization of the input prompt is performed before storage.
- [PERSISTENCE]: The skill instructions specify appending refined prompts to
.ai/PROMPT.mdto maintain state across sessions. This behavior is documented and requires explicit user confirmation via tools likeAskUserQuestion. - [COMMAND_EXECUTION]: The
SPEC.mdfile references variouspython3commands for skill validation and testing (e.g.,distiller.py validate-plugin). These are development-time maintenance instructions rather than runtime commands executed during normal use.
Audit Metadata